A multi-agent RAG framework for telecom cybersecurity: Multi-generational threat intelligence and SOC assistance

Telecommunications networks from 2G to 6G face escalating, generation-specific cyber threats, ranging from SS7 exploits in legacy systems to IoT botnets in 5G and network slicing abuse in emerging 6G that strain traditional Security Operations Center (SOC) capabilities. Conventional tools rarely encode telecom protocol semantics, while generic AI chatbots lack grounding in vendor advisories, standards, and generation-aware context, leaving critical gaps in threat investigation and response. This paper presents a domain-specific Retrieval-Augmented Generation (RAG) framework for telecom cybersecurity that bridges multi-generational network threats with AI-assisted defense. The system unifies structured sources (e.g., CVEs, MITRE ATT&CK) and unstructured telecom security documents (GSMA and ETSI white papers, specialized research) into a hybrid dense–sparse vector knowledge base. On top of this corpus, a hybrid retrieval pipeline combines BGE-M3 embeddings, reciprocal rank fusion, neural reranking, and strict generation guardrails to deliver precise, context-aware, and faithful responses. The resulting framework provides 24/7, telecom-native assistance for SOC analysts, enabling rapid threat triage, protocol-specific mitigation strategies, and cross-vendor intelligence correlation, thereby strengthening the resilience of modern telecom ecosystems.